Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

Rabbit23_116296's avatar
Rabbit23_116296
Icon for Nimbostratus rankNimbostratus
Jan 28, 2016

x-frame-options settings not working in APM

I have /my.policy overwriting every attempt I've made to disable this clickjacking protection. I have a frame that needs to access APM and this damn header is constantly getting set. Using BIGIP 12, ...
BIG-IP Access Policy Manager (APM)
devops
irules
Lucas_Thompson_'s avatar
Lucas_Thompson_
Historic F5 Account
Jan 28, 2016

Try doing "bigstart restart". The ramcache in BIG-IP stores the pages for APM's HTTP server so that the server itself doesn't have to deal with incoming client requests. I tested this in v12.0 and it seems to be fine, but it does require a restart.

 

  • Lucas_Thompson_'s avatar
    Lucas_Thompson_
    Historic F5 Account
    Jan 28, 2016
    Also: The thing that has to be "none" isn't apm.xframeoptions.allowfrom , it's apm.xframeoptions. The alowfrom sets the domains, not "none".